gotop CVE-2026-91784

Requires the attacker to have an existing local account/shell on the same host as the victim, and requires the victim (gotop user) to actively invoke gotop's process-kill feature against the attacker-controlled, maliciously-named process - this user interaction is the primary limiting factor. The attacker must be able to launch a process whose name begins with '--' and encodes a pkill option (such as a target UID). The flaw is in gotop's handling of process names passed to pkill at version 3.0.0; it is not remotely reachable and does not affect single-user systems where there is no distinct 'targeted user' to attack. No special gotop configuration is required beyond normal use of the kill functionality.

This is a genuinely low-priority issue despite being a real, confirmed vulnerability. The CVSS 4.0 base score of 4.8 (vendor-supplied vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) correctly reflects limited real-world risk: exploitation requires LOCAL access (AV:L), depends on victim interaction (UI:P) - specifically the gotop user must choose to kill the attacker's maliciously-named process - and the only impact is limited availability (VA:L), with NO confidentiality or integrity impact. There is no EPSS score, no KEV listing, and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' All signals align consistently here - there is no conflict between CVSS, exploitation data, or description. The one notable caveat is that the product is retired/unmaintained with no fix available, so any affected deployment is permanently exposed; however, gotop is a niche terminal activity monitor, and the attack is a privilege-less local user degrading another local user's processes on a shared host, which is an uncommon and narrow threat model. This is a low-severity, bounded availability flaw, not an urgent remediation item.

On a multi-user Linux host, a low-privileged local attacker starts a long-running process whose name is crafted to begin with '--' and embeds a target user's UID (e.g. '--uid=1001'). When an administrator or another user running gotop selects that process and invokes gotop's kill feature, gotop passes the name unsanitized to pkill, which interprets it as a command-line option and terminates all processes owned by the targeted UID. No public exploit code is referenced, but the technique is trivial to reproduce.